Windows 2003 Active Directory and GPO

The Quick and the Dirty of Group Policy:

you create containers [OUs] to collect users or computers. You create a Group Policy object [a template of configurations you want the user to have or the computer to have. you then link the GPO [template] to the container [OU].

So do you have to manually add all of the users into the OU or can you add a group of users?

As already stated, you apply different group policies to different groups of users (or computers) by placing the users in separate Organization Units (OUs). An "OU" is just an object within AD Users and Computers, sort of like a subgroup. All of the objects in AD Users and Computers (Computers, Users, etc.) are OUs. With the AD Users and Computers console open, you simply right click on the domain name and select New/Organizational Unit. Once you create the OU, you can just move your existing users into the unit where you want them. You can click and drag them from one unit to another, or you can right-click on the user, click "Move" and then select the new OU from the list.

Then when you create new users, you create them in the OU where you want them.

When you apply your new group policies, one thing you have to be careful about is whether there are already policies set in the Default Domain group policy object. If this group policy has any settings enabled, these settings will supercede any settings in individually applied group policies, unless you block policy inheritance. The "Block policy inheritance" check box is on the Group Policy tab of the properties of the new OU. (This tab doesn't exist on the default OUs like Users and Computers, as they always inherit the default domain policy settings.)

When you create your various group policies, you then apply them to the OU by adding them on the Group Policy tab in the properties of the OU.

Hope this helps!

Download Microst Group Policy Manager
from:
http://www.microsoft.com/downloads/details.aspx?FamilyID=0a6d4c24-8cbd-4b35-9272-dd3cbfc81887&DisplayLang=en
It allows easier configuration

This question was closed by the author